Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.1The Z-Downloads WordPress plugin before 1.11.7 does not properly validate uploaded files allowing for the uploading of SVGs containing malicious JavaScript.Check if you run itEPSS 1.81%May 15, 2025
- Medium6.5The Secure Downloads WordPress plugin before 1.2.3 is vulnerable does not properly restrict which files can be downloaded.Check if you run itEPSS 0.53%May 15, 2025
- Medium6.1In the process of testing the Simple Job Board WordPress plugin before 2.12.2, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embeddinCheck if you run itEPSS 0.38%May 15, 2025
- Critical9.8The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthCheck if you run itEPSS 0.68%May 15, 2025
- Medium6.1wp-buy wp_content_copy_protection_\&_no_right_click URL Redirection to Untrusted Site ('Open Redirect')Patch nowKEVEPSS 0.53%May 15, 2025
- Medium6.1The KBucket: Your Curated Content in WordPress plugin before 4.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-SiteCheck if you run itEPSS 0.33%May 15, 2025
- Critical9.8The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX actionCheck if you run itEPSS 2.79%May 15, 2025
- Medium6.1The S3Player WordPress plugin through 4.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which couldCheck if you run itEPSS 0.37%May 15, 2025
- Medium6.1The Badgearoo WordPress plugin through 1.0.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which coulCheck if you run itEPSS 0.34%May 15, 2025
- Medium6.1The 360 Product Rotation WordPress plugin through 1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site ScriptingCheck if you run itEPSS 0.37%May 15, 2025
- Medium6.1The MemberSpace WordPress plugin before 2.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which couCheck if you run itEPSS 0.63%May 15, 2025
- Medium6.1The LifterLMS WordPress plugin before 8.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which couldCheck if you run itEPSS 0.58%May 15, 2025
- Medium6.1The Custom Field Manager WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting whCheck if you run itEPSS 0.59%May 15, 2025
- Medium4.8The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site ScriCheck if you run itEPSS 0.36%May 15, 2025
- Medium6.1The Advance Post Prefix WordPress plugin through 1.1.1, Advance Post Prefix WordPress plugin through 1.1.1 does not sanitise and escape a parameter before outputting it back in theCheck if you run itEPSS 0.58%May 15, 2025
- Medium6.1The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting wCheck if you run itEPSS 0.34%May 15, 2025
- Medium6.1The AffiliateImporterEb WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting wCheck if you run itEPSS 0.58%May 15, 2025
- Medium6.1The ClipArt WordPress plugin through 0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could beCheck if you run itEPSS 0.34%May 15, 2025
- Medium6.1The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site ScriCheck if you run itEPSS 0.35%May 15, 2025
- Medium6.1The WP DeskLite WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which couCheck if you run itEPSS 0.58%May 15, 2025
- Medium6.1The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings and is missing CSRF protection which could allow subscribers to perform StorCheck if you run itEPSS 0.18%May 15, 2025
- Low2.7The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private informatCheck if you run itEPSS 0.42%May 15, 2025
- Medium6.1Horilla is a free and open source Human Resource Management System (HRMS).Check if you run itEPSS 0.23%May 15, 2025
- Critical9.4Atheos is a self-hosted browser-based cloud IDE.Check if you run itEPSS 0.49%May 15, 2025
- High8.9Emlog is an open source website building system.Check if you run itEPSS 0.77%May 15, 2025
Sort